General

  • Target

    8dec5a3e208203d25c1805e8965177bcac409c5f0b3758d3e6d7847595d362ed

  • Size

    706KB

  • Sample

    230422-dbdkwadh2t

  • MD5

    a095259892f3bcfad7864395ca4295d2

  • SHA1

    b4905280aa674dea3cdedbf3cb88220b495e8b02

  • SHA256

    8dec5a3e208203d25c1805e8965177bcac409c5f0b3758d3e6d7847595d362ed

  • SHA512

    143b961e92ef038c40b57cd296bc09cbb61e3848b11de7fa1ffebeba3d5836fb28783869d1b877dfd35495b769edc2357c375e969908c56f3e832d181d4bf111

  • SSDEEP

    12288:By90ixdG4XS7IRJH7jAhnpwY1XhywJ2b/QRFgrhiU6ObjVh5Harrq3+:ByZXXt7kzv14/4RJU60X5en

Malware Config

Targets

    • Target

      8dec5a3e208203d25c1805e8965177bcac409c5f0b3758d3e6d7847595d362ed

    • Size

      706KB

    • MD5

      a095259892f3bcfad7864395ca4295d2

    • SHA1

      b4905280aa674dea3cdedbf3cb88220b495e8b02

    • SHA256

      8dec5a3e208203d25c1805e8965177bcac409c5f0b3758d3e6d7847595d362ed

    • SHA512

      143b961e92ef038c40b57cd296bc09cbb61e3848b11de7fa1ffebeba3d5836fb28783869d1b877dfd35495b769edc2357c375e969908c56f3e832d181d4bf111

    • SSDEEP

      12288:By90ixdG4XS7IRJH7jAhnpwY1XhywJ2b/QRFgrhiU6ObjVh5Harrq3+:ByZXXt7kzv14/4RJU60X5en

    • Modifies Windows Defender Real-time Protection settings

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

MITRE ATT&CK Enterprise v6

Tasks